T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:9
- Finding
- Third-Party CLI Installation and Execution Without Integrity Verification<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md` lines 9, 45, 51, and 54; `SKILL-cn.md` lines 9, 45, 51, and 54 **Vulnerability Type**: Supply-chain risk from an externally retrieved npm dependency **Risk Level**: Medium ### Vulnerable Code The package is installed globally or executed directly through `npx`: ```yaml metadata: {"clawdbot":{"emoji":"🤖","requires":{"bins":["npm","npx"]},"install":"npm install -g @dlazy/cli@1.2.3","installAlternative":"npx @dlazy/cli@1.2.3","homepage":"https://github.com/dlazy-ai/cli","source":"https://github.com/dlazy-ai/cli","author":"dlazyai","license":"see-repo","npm":"https://www.npmjs.com/package/@dlazy/cli","configLocation":"~/.dlazy/config.json","apiEndpoints":["api.dlazy.com","files.dlazy.com"]}} ``` ```text - **npm package name**: `@dlazy/cli` (this skill's install field is fixed to version `1.0.9`) ``` ```bash npx @dlazy/cli@1.2.3 <command> ``` ```text The skill's `metadata.clawdbot.install` field is fixed to `npm install -g @dlazy/cli@1.2.3`. ``` ### Technical Analysis The Skill directs the agent or user to retrieve and execute `@dlazy/cli@1.2.3` from the npm ecosystem. Although the command pins a package version, the project does not provide or verify an expected package-integrity digest, a reproducible-build attestation, or an exact mapping between the reviewed source commit and the published npm artifact. Installation through `npm install -g` may execute package lifecycle scripts with the permissions of the invoking user. Likewise, `npx` downloads and executes the published package without allowing the Skill's local contents to establish that the downloaded artifact is identical to reviewed source code. The provenance documentation also states that the install field is fixed to version `1.0.9`, while the actual installation and execution commands specify version `1.2.3`. This inconsistency can cause reviewers to inspect a different release from the one ultimately executed. This finding do ...[truncated 1802 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Correct the version discrepancy so every provenance statement, installation field, example, and reviewed release identifies the same exact package version. 2. Record and verify the expected npm artifact integrity digest before installation or execution. Fail closed if the downloaded artifact does not match. 3. Map the npm release to an immutable source commit and provide reproducible-build or signed provenance attestations that allow reviewers to confirm that the published artifact was built from that commit. 4. Prefer a project-local, lockfile-controlled installation over global installation to reduce system-wide effects and improve dependency reproducibility. 5. Avoid lifecycle scripts where they are unnecessary. Use installation controls such as `--ignore-scripts` when compatible with the CLI, and explicitly document any lifecycle script that must run. 6. Review the complete dependency tree and commit the applicable lockfile or equivalent dependency manifest with integrity data. 7. Consider bundling the minimal reviewed implementation with the Skill when practical, rather than dynamically retrieving the effective executable at invocation time. 8. Run the CLI under a dedicated, non-privileged account or sandbox with access restricted to required files, environment variables, and network endpoints. ]]>